Self-Configuring Cellular Basestation

ABSTRACT

A basestation for cellular wireless communications network is able to configure itself for the operation in the network, by selecting appropriate operating frequencies (in the case of a GSM network) or scrambling codes (in the case of a UMTS network), and appropriate transmit powers. This makes it practical for a large number of such basestations to be deployed in a network, within customers&#39; premises, without requiring network intervention in each case.

This invention relates to a cellular basestation, and in particular to abasestation for a cellular communications network, that can convenientlybe used to provide a cellular service, for example within a home oroffice.

Wide area cellular services for standards such as GSM and UMTS areprovided from conventional basestations which are capable of covering alarge area (cell radius of many kilometres). However, coverage withinbuildings can be more challenging because of the RF attenuation of thebuilding structure and radio shadowing effects from surroundingbuildings. This coverage problem becomes more difficult for standardsaiming to support medium to high speed data such as EDGE and UMTSbecause of the higher signal-to-noise figures required for signals usinghigh-order constellations or low spreading factors. Higher frequenciessuch as those used for UMTS also accentuate the problem because thesesignals suffer greater attenuation through building structures.

Conventional solutions to these problems would be to deploy many morebasestations and RF repeater systems to increase coverage withinbuildings and urban areas. These solutions become prohibitively costlyand the additional aesthetic impact of many more basestations/aerials inpopulated areas creates objections from residents and additional legalexpenses for operators. The use of short-range radio interfaces such asWiFi or Bluetooth to handle cellular traffic within a home or office isan alternative approach, but requires the customer or operator to investin new handsets which on a large scale becomes a major expense initself.

Recent figures suggest over 70% of all cellular calls are made withinbuildings so this issue presents some significant obstacles to thefuture growth of the cellular industry.

According to a first aspect of the present invention, there is provideda basestation, for use in a cellular communications system, comprising:

-   -   a radio frequency receive path;    -   a radio frequency transmit path; and    -   a connection for a network;    -   wherein, on installation, the basestation is adapted to:    -   configure the radio frequency receive path to operate in a        wireless communications network;    -   monitor received signal strengths on each of a predetermined        plurality of network carriers;    -   select, on the basis of said received signal strengths, a first        of said predetermined plurality of network carriers as an        operating downlink carrier; and    -   select, on the basis of the received signal strength of said        selected first of said predetermined plurality of network        carriers, an initial power level for said radio frequency        transmit path; and    -   wherein the basestation is further adapted to operate using said        operating downlink carrier and a corresponding operating uplink        carrier, following said installation.

According to a second aspect of the present invention, there is provideda basestation, comprising:

-   -   radio transceiver circuitry, for connection to wireless        communications devices by means of a cellular wireless        communications protocol; and    -   an interface, for connection over an IP network;    -   wherein the basestation is adapted to communicate using UMA        standard protocols over said IP network with a UMA network        controller, in order to provide communications with said        wireless communications devices by means of said cellular        wireless communications protocol.

According to a third aspect of the present invention, there is provideda basestation, for use in a cellular communications network, wherein thebasestation is operable such that only specific preconfigured mobilestations are able to connect to said network by means of thebasestation.

According to a fourth aspect of the present invention, there is provideda telecommunications network, comprising:

-   -   a plurality of basestations, each having a respective connection        to a cellular wireless communications network, and each having a        respective connection to an IP network;    -   wherein a mobile communications device, active in said wireless        communications network, can perform a handover from one of said        basestations to another of said basestations, without requiring        intervention of said cellular network.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a communications system including abasestation in accordance with the present invention;

FIG. 2 is a block diagram of the hardware architecture of a basestationin accordance with the present invention;

FIG. 3 is a block diagram of the software architecture of a basestationin accordance with the present invention;

FIG. 4 illustrates a part of the protocol architecture of a systemaccording to an aspect of the present invention;

FIG. 5 illustrates a part of the protocol architecture of a systemaccording to an aspect of the present invention;

FIG. 6 illustrates a part of the protocol architecture of a systemaccording to an aspect of the present invention;

FIG. 7 illustrates a part of the protocol architecture of a systemaccording to an aspect of the present invention;

FIG. 8 illustrates a part of the protocol architecture of a systemaccording to an aspect of the present invention;

FIG. 9 illustrates a process according to an aspect of the presentinvention;

FIG. 10 illustrates a process according to an aspect of the presentinvention;

FIG. 11 illustrates a process according to an aspect of the presentinvention;

FIG. 12 illustrates a process according to an aspect of the presentinvention;

FIG. 13 illustrates a process according to an aspect of the presentinvention;

FIG. 14 illustrates a process according to an aspect of the presentinvention;

FIG. 15 illustrates a process according to an aspect of the presentinvention;

FIG. 16 illustrates a process according to an aspect of the presentinvention;

FIG. 17 illustrates processes according to an aspect of the presentinvention;

FIG. 18 illustrates a process according to an aspect of the presentinvention;

FIG. 19 illustrates a process according to an aspect of the presentinvention;

FIG. 20 illustrates a process according to an aspect of the presentinvention;

FIG. 21 illustrates a process according to an aspect of the presentinvention;

FIG. 22 illustrates a process according to an aspect of the presentinvention;

FIG. 23 illustrates a process according to an aspect of the presentinvention;

FIG. 24 illustrates a process according to an aspect of the presentinvention;

FIG. 25 illustrates a process according to an aspect of the presentinvention;

FIG. 26 illustrates a process according to an aspect of the presentinvention;

FIG. 27 illustrates a process according to an aspect of the presentinvention;

FIG. 28 illustrates a process according to an aspect of the presentinvention; and

FIG. 29 illustrates a process according to an aspect of the presentinvention.

FIG. 1 illustrates a communication system 100, incorporating abasestation 110 in accordance with the present invention. In thisexemplary embodiment, the basestation 110 is intended to providecoverage within a building, such as a home or office 120, for voice anddata services using both GSM/GPRS and UMTS air interfaces withinexisting cellular communications networks, allowing the use of existingcellular mobile phones 122, without the need for significantmodification. As described in more detail below, the basestation 110also provides flexible interfacing to the network operator's corenetwork 130 via the Unlicensed Mobile Access (UMA) or Session InitiationProtocol (SIP) standards, as opposed to the usual lub (UMTS) or Abis(GSM) interfaces used by conventional cellular basestations. Backhaulfrom the basestation units, referred to as ZoneGates, is achievedthrough the use of Digital Subscriber Line (DSL) connections 140 overthe home or office fixed line phones; this approach enables low-costtransport of data and voice using Voice-over-Internet Protocol (VoIP)techniques.

FIG. 2 is a block schematic diagram, illustrating in more detail aspectsof the hardware architecture of the basestation 110.

The architecture consists of a number of functional blocksinterconnected by a processor bus 202 such as the ARM AMBA bus. Themajor blocks are described below.

Firstly, the basestation 110 supports various external wired interface,as described below.

The basestation 110 preferably includes an internal ADSL modem/router204. Router functionality will include NAT and DHCP server.

USB 1.1 interface 206. In the absence of an internal ADSL modem/routerthis USB interface 206 will support connection to an external DSL modem.If the internal ADSL modem 204 is incorporated, the USB interface 206provides a connection to a local PC for broadband internet service andadvanced configuration/control of the basestation 110.

RJ45 Ethernet 10/100/1000 interface 208. This interface providesconnection to an external local area (for example, home or office)network (not shown in FIG. 2) for advanced configuration/control of thebasestation 110 and allowing basestation access to external devices foradvanced service provision. With the internal DSL modem 204 included,the Ethernet port 208 is used for broadband Internet service as a moreflexible alternative to the USB port 206.

As described in more detail below, multiple basestation units 110installed in a large indoor area and connected to a common Ethernet LANcan manage handovers between themselves without the intervention ofother systems in the operator's radio network 150 or core network 130.

RJ11 Standard Pots Telephone Connection. POTS phone and fax services aresupported via a RJ11 phone connector. A SLIC device 210 driving theconnector is preferably configurable to support a number of nationalstandards, for example including UK, Germany, France, Italy, Spain,Japan and USA. Voice service is provided via VoIP using appropriatestandard codecs 212. Analogue fax service is also supported. This portwill not provide line power.

USIM interface 214. The basestation 110 will have provision for aSubscriber Identification Module (SIM) card interface to allow use of astandard SIM card to identify the unit uniquely to the Management System160 and the network operator's radio network 150 and core network 130,and hence enable certain services, as described in more detail below.

The basestation 110 includes a Protocol Engine 216 implemented as asmall embedded CPU such as an ARM926 (with appropriate peripherals)supported by dedicated co-processors 218, 220 respectively forEncryption and Packet Processing which will offload the main CPU forspecific intensive tasks. Protocols implemented on the Protocol Engine216 include:

Session Control, Including Web Server, DHCP Server and OSGi Server;GSM/UMTS Access Stratum (NAS) Functions; GERAN Access Stratum Functions;UMA Client; and SIP Client.

The Packet Processing Accelerator 220 handles formatting of the packetsflowing to/from the GSM/GPRS Layer 1 functions implemented in theBaseband Modem 222, and formatting of the packet streams to/from theUMTS Layer 1 functions implemented in the Baseband Modem 222. The PacketProcessing Accelerator 220 also formats VoIP packets to/from the POTSinterface. VoIP codec functions are supported by the Baseband Modem 222.

Encryption of the IPSec packet payload is handled by the EncryptionAccelerator 218. AES and 3DES encryption protocols will be supported.Only the ZoneGate's VPN connection to UNC/Management System will makeuse of the internal encryption processing; user VPN encryptionprocessing will be handled outside the basestation 110.

The main CPU 216 is also responsible for the configuration and control,via the main CPU bus 202, of all functional blocks in the systemincluding the Baseband Modem 222, USB port 206, Ethernet port 208, and,optionally, the ADSL modem/router 204 and a WiFi transceiver 224. Thesystem software image, including configuration data for all systemfunctional blocks is stored in FLASH memory 226 within the basestation110; two complete system images are stored so that updated system imagescan be downloaded to the basestation 110 from the Management System 160,whilst the previous image is retained as a fall back option in case ofcorrupted download.

The main CPU peripherals include:

Watchdog timers for software sanity checking; JTAG and serial ports forin-system debug; and GPIO for system control including LED statusindication, system power management and system alarm gathering.

The basestation 110 supports sample rate processing, chip-rateprocessing (UMTS only) and symbol rate processing for GSM and UMTSbasestation modems, and supports simultaneous GSM and UMTS operation.Limited GSM Mobile Station (MS) and UMTS User Equipment (UE) modemfunctionality will also be implemented to allow the basestation 110 torecover the Broadcast Channel (BCH) from local GSM/UMTS basestations andother nearby similar basestations 110. UE modem mode will be enteredduring initial installation to survey the local RF environment and atregular intervals after the initial installation to monitor the RFenvironment and, if necessary, modify the configuration of thebasestation 110.

The DSP functionality included in the Baseband modem 222 is also usedfor VoIP codec implementation.

The baseband modem is implemented using a software-based architecture toensure high adaptability of the modem over a field life of at least 5years. The performance of the GSM and UMTS basestation modems isadequate for stationary or pedestrian users moving at no more than 10kmh within a radius of 50 m from the basestation 110.

The Baseband Modem 222, being software based, is upgradeable to allowfuture enhancement to HSDPA or EDGE service to be delivered in the fieldwithout the need to replace the unit.

The basestation 110 has GSM RF circuitry 226 and UMTS RF circuitry 228,each connected to the baseband modem 222 through a modem-analoginterface 230, to support simultaneous operation of GSM at either 900MHz or 1800 MHz and UMTS at 2100 MHz. For the GSM and UMTS receive pathsboth uplink (basestation receive) and downlink (terminal receive)frequencies are accessible; for the transmit paths only downlink(basestation transmit) frequencies are available. At installation thebasestation 110 selects a downlink RF carrier frequency with lowestnoise/interference for both GSM and UMTS from a permitted list of GSMand UMTS carrier frequencies provided by the Management System 160;permitted downlink frequencies will be scanned by the basestation 110with its receive path configured in UE mode and its transmit pathdisabled.

The basestation 110 is designed to provide cellular service over adistance of 50 m or less to stationary or pedestrian users within abuilding, hence the transmit power required is dramatically reducedcompared to a conventional basestation.

The basestation 110 includes timing and frequency references 236 whichprovide sufficient accuracy for GSM and UMTS basestation operation overa 5 year lifetime.

The basestation 110 therefore provides a services platform which canexploit the potential of the union of three data networks within thebasestation 110, namely the external core network (via DSL), mobiledevices (via GSM/UMTS) and the home network (via Ethernet).

FIG. 3 illustrates the major components of the protocol softwarearchitecture implemented on the Protocol Engine CPU 216.

A basestation Session Control subsystem 302 manages and implements theservice flows and policies that determine how the basestation 110 isset-up and functions for any particular Mobile Network Operator (MNO)configuration and end-user settings. Functions of the Session Controllerinclude:

Implementation of the policies for registration, call control andtraffic flow for the basestation on the MNO core network;

Control of the UMA and SIP clients for registration, call control andtraffic flow;

Control of information flow with the network based Management System;Management of the basestation Radio Access Network (RAN) resources formobile registration and call handoff;

Control and execution of the MNO and end-user provisioningmethodologies;

Management of the basestation Packet Core policies; and

Handling of Java based application requests for network resources.

The Non-Access Stratum 304 functionality is required in order forservices to be provided to the UE when the MNO GSM/UMTS core-network isnot connected to the basestation, which would typically be the case forbasestations connecting over SIP. This functionality enables thebasestation 110 to offer the usual GSM/UMTS services such as SMS and MMSwhich mobile users are accustomed to, whilst not being connected to theGSM/UMTS core network 130. In order for such services to be offered, thebasestation 110 contains a condensed subset of the core-networkfunctions usually contained in the Mobile Switching Centre (MSC),Serving GPRS Service Node (SGSN), GSM Basestation Subsystem (BSS), andUMTS Radio Network Subsystem (RNS).

The Non-Access Stratum 304, as implemented in the basestation 110,comprises the following functions:

Call Control (CC) 306—supports call establishment between two peerentities, mainly for circuit-switched connections. For the basestation,also provides the mapping between SIP call establishment andcircuit-switched voice call over GSM and UMTS.

Session Management (SM) 308—Control of packet data sessions.

Short Message Service server (SMS) 310—transmission of SMS messagesbetween the basestation 110 and the network SMS service centre.

MultiMedia Messaging Service server (MMS) 312—transmission of multimediamessages between the basestation UEs and the network MMS service centre.

Supplementary Services (SS) 314—implementation for services such as callwaiting, call holding, and multi-party.

Mobility Management/GPRS Mobility Management (MM/GMM) 316—management ofUE mobility elements, such as Location Registration, authentication, andciphering.

USIM 318—control functions associated with the SIM card which may befitted to the basestation 110.

The Access Stratum 320 comprises the lower-level functionality that isparticular to GSM EDGE Radio Access Network (GERAN), and UMTS. The GERANfunctionality is selected for GSM, GPRS and EDGE access, and UMTSfunctionality for UMTS-enabled services.

The GERAN access stratum functionality 322 comprises both BSS (Layer-1324, Radio Resource 326, Radio Link Control 328/Medium Access Control330) and SGSN (Link Layer Control 332 and Sub-Network DependentConvergence Protocol 334) functionality. The BSS functionality isrequired for basestation support of all GSM/GPRS/EDGE servicessupporting regardless of the interface used between the basestation andthe MNO core network. The SGSN functionality is required only when MNOGERAN core-network functionality is bypassed, for example for SIP andInternet-based services over GERAN.

The GERAN access stratum functionality 322 therefore comprises thefollowing elements:

Sub-Network Dependent Convergence Protocol (SNDCP) 322—Multiplexing ofseveral packet data protocols; data compression/decompression(optional); header compression/decompression (optional); segmentationand re-assembly.

Logical Link Control (LLC) 332—LLC provides peer-to-peer unacknowledgedand acknowledged data transfer, and the GPRS ciphering functionality.

Radio Link Control/Medium Access Control (RLC/MAC) 328, 330—RLC/MACsupports acknowledged and unacknowledged modes; segmentation andreassembly of LLC PDUs; multiplexing to several physical channels;broadcast of system information.

Radio Resource Management (RR) 326—RR connection establishment,maintenance, and releases; system information broadcast; packet dataresource management.

GSM/GPRS Layer 1 324—Interface to the GSM/GPRS/EDGE modem functionsimplemented in the Baseband Modem 222.

The UMTS Access Stratum functionality 336 comprises Radio NetworkController (RNC) functionality (Radio Resource Control, Packet DataConvergence Protocol, Radio Link Control/Medium Access Control) andinterface to the UMTS physical layer implemented on the Baseband Modem222. The RNC and physical layer interface functionality is required forall basestation services supporting UMTS regardless of the core networkinterface used.

The UMTS access stratum functionality 336 comprises the followingelements:

Packet Data Convergence Protocol (PDCP) 338—Header compression anddecompression of IP data streams (optional), transfer of user data,maintenance of PDCP sequence numbers.

Radio Resources Control (RRC) 340—Broadcast of information related tothe NAS and AS; establishment, maintenance and release of RRCconnections; establishment, reconfiguration and release of Radio Bearersand radio resources; RRC connection mobility functions; control ofrequested QoS; UE measurement reporting and control; outer loop powercontrol; ciphering control.

Radio Link Control (RLC) 342—Transmission and reception of signaling anddata packets, including buffering, segmentation and concatenation ofpackets. Comprises three entity types, for acknowledged mode,unacknowledged mode, and transparent modes.

Medium Access Control (MAC) 344—Mapping between logical channels andtransport channels, selection of the appropriate Transport Formats foreach Transport Channel, priority handling between UEs,multiplexing/demultiplexing of upper layer PDUs to/from transport block(sets) on common and dedicated transport channels.

UMTS Layer 1 346—Interface to the UMTS modem functions implemented onthe Baseband Modem 222.

The software architecture shown in FIG. 3 also includes a UMA client348. The basestation 110 uses the UMA protocol in a non-standardconfiguration. The standard UMA protocol is designed to enable a GSM MSor UMTS UE which includes a UMA client and an unlicensed spectrum airinterface such as IEEE802.11b/g or Bluetooth to communicate with theGSM/UMTS core network using unlicensed spectrum. The implementation inthe basestation according to the present invention uses the UMA client348 as part of the network interface of a GSM/UMTS basestation so thatUMA protocols developed to communicate with a GSM/UMTS core network viaan Unlicensed Network Controller (UNC) can be used to manage callshandled by that basestation, including handover to/from the macronetwork.

The use of UMA in the basestation of the present invention is describedin more detail later.

SIP Client 350. The basestation 110 maps the GSM/UMTS protocols onto theSIP-client protocol so that the standard GSM/UMTS mobile services aremapped by the basestation onto the corresponding SIP services. Theapproach removes the need for SIP protocols or SIP services to bepresent or implemented on the MS/UE. For example, a standard GSM/UMTSvoice call is mapped to a VoIP SIP call in the basestation 110, whichalso includes the mapping of the additional signaling required in orderto register the user in the SIP core-network, and to originate,terminate, and clear the voice call. The complete GSM/UMTS protocolstack, which includes the BSS/RNS, and MSC/SGSN functionality isrequired in the basestation in order to implement the GSM/UMTSsignaling.

The software architecture shown in FIG. 3 also includes IP TransportLayers 352. The IP transport layers 352 contain the standard Internetprotocols, such as UDP 354, TCP 356, and IPv4 358. Additional protocolsare implemented in order for the basestation 110 to support the requiredsignaling functionality. IPSec 360 is required in order to provide anencrypted and secure transmission medium between the basestation 110 andthe core network 130, which is required to maintain the secureconnection between the user mobile station 122 and the core network 130.This is particularly important as ciphering encryption is a standardfeature for the GSM/UMTS air interface, and encryption is mandatory forthe transfer of secure information such as security and ciphering keysbetween the basestation 110 and the core network 130. Remote IP 362 isimplemented to enable user mobility within a packet network.

The software architecture shown in FIG. 3 also includes circuit-switchedfunctionality 370, including a set of voice codecs 364 in order that astandard POTs connection (to a standard analogue telephone) can be madeto the core network using SIP (VoIP). In addition, a Fax codec 366enables the connection of a standard fax machine to the basestation 110for the transmission and reception of faxes over the Internet againusing SIP (FoIP).

The basestation 110 is a compact unit designed to be mounted on atable-top or internal wall or ceiling within the home or office.Unusually for a GSM/UMTS basestation, no cell planning is required toinstall the basestation 110 due the low transmit power levels andself-configuration for frequency/scrambling code.

Following physical installation, insertion of SIM card (if required) andconnection of external DC power and network connection via DSL or cablethe basestation 110 executes the following sequence of operations:

1. Establishes communications with the Basestation Management System160, completes authentication with the Management System using datarecorded in the SIM and downloads various configuration parametersincluding the “Permitted List” of carrier frequencies and UMTSscrambling codes that the mobile network operator providing thebasestation service chooses to allow.

2. The RF receive path is configured to operate on the GSM mobile phonedownlink frequencies so that surrounding GSM basestations (and otheractive basestations in accordance with the invention) can be detectedand identified. The Baseband modem 222 is then configured as a GSMmobile phone baseband receiver such that the Synchronisation andBroadcast Channels transmitted by surrounding basestations can be fullydemodulated and system information parameters recovered. The basestation110 then monitors each of the GSM carrier frequencies in the PermittedList in turn measuring the signal strength of the basestation as a GSMmobile would in accordance with GSM standards. The signal strengths andBroadcast Channel information of the detected basestations is stored forfuture reference.

3. The RF receive path is configured to operate on UMTS downlinkfrequencies and the baseband modem is configured as a UMTS UserEquipment capable of demodulating the Primary and SecondarySynchronisation channels (to determine scrambling code) and theBroadcast Channel so that System Info messages can be recovered. Thebasestation 110 then monitors each of the UMTS carriers and scramblingcodes in the Permitted List in turn, measuring the Carrier toInterference ratio for each detected basestation (including otherbasestations in accordance with the invention) in the same way that aUMTS UE would. The C/I ratio and System Info data recovered for eachdetected basestation is stored for future reference.

4. The basestation 110 then selects the GSM carrier and UMTS carrier andscrambling code within the Permitted List with minimum received powerfrom surrounding basestations (including other basestations inaccordance with the invention) on the principle that these carriers willcause minimum interference to surrounding macrocells/microcells or otherbasestations in accordance with the invention. The RF transmit paths forGSM and UMTS are configured to the selected carrier frequencies andscrambling codes ready for operation. The basestation 110 RF receivepaths are configured to monitor the uplink frequencies corresponding tothe selected downlink carriers in accordance with the standardisedpairing of downlink and uplink carrier frequencies in the GSM and UMTSFrequency Division Duplex schemes.

5. The basestation 110 then selects initial power levels for the GSM andUMTS transmit paths. An appropriate initial power level is deduced fromthe received signal strength/C/I detected by the basestation 110. Thegoal is that the transmitted power level is sufficient to providecellular service at a distance of 20 m assuming the level of in-bandinterference created by surrounding basestations (including otherbasestations in accordance with the invention). Transmit Power ismodified in call to maintain acceptable Quality of Service (QoS) inaccordance with GSM and UMTS standards—the basestation 110 RF hardwareimposes an upper limit on transmit power which is low enough to preventthe basestation 110 creating unacceptable interference in the event of asoftware malfunction.

6. The system information extracted from the broadcast channels ofsurrounding GSM and UMTS basestations is used to create a BA list forthe GSM and UMTS Broadcast Channels transmitted by the basestation 110in accordance with GSM and UMTS standards. This BA list identifiessurrounding basestations which should be monitored by a mobile receivingthe BA list in readiness for a handover should the signal level of thebasestation 110, as received at the mobile, fall below acceptablelimits. The BA lists for GSM and UMTS are reported back to theManagement System 160.

7. The basestation 110 will begin transmission on the selected GSM andUMTS carriers at the initial power levels selected.

8. If the basestation 110 is part of a group of basestations inaccordance with the invention, which share a common LAN connection andare able to handover to each other, then the BA list may be updated withinformation regarding other basestations within the group to allow amobile to handover between such basestations, as described in moredetail below.

The basestation unit 110 is designed to repeat the RF surveying processat regular intervals (every 1-10 days) following initial installation sothat changes to the RF environment can be detected and previousdecisions regarding carriers/scrambling codes can be re-evaluated ifnecessary.

As mentioned above, the basestation 110 uses the protocols defined forthe UMA standard in a novel way to allow the basestation 110 tocommunicate over the broadband IP network 170 with a UMA UNC 152, andthereby provide communications between a mobile station (MS) 122 toGSM/UMTS radio networks 150 (to support seamless handoff) and corenetwork 130 (to provide standard GSM/UMTS services). The basestation 110software protocol stack maps the standard GSM/UMTS air-interfaceprotocol to the UMA protocol, as shown in FIG. 4 for UMA-to-GSM, andFIG. 5 for UMA-to-GPRS

For GSM (FIG. 4), the relay function within the basestation protocolstack maps the GERAN Radio Resources (RR) protocol directly to theUMA-RR protocol which is terminated in the UNC 152. The basestation 110requires a full RR sub-layer implementation in order to communicate withthe MS(s) 122 that are currently registered with the basestation. Asubset of RR tasks are relayed to the UMA-RR sub-layer, in order tocommunicate with the core network (for example handovers).

For GPRS (FIG. 5), the basestation implements the RLC/MAC sub-layers inorder to communicate with the registered MS(s) 122. The relay functionwithin the basestation 110 maps the RLC/MAC sub-layers to the UMA-RLCsub-layer which is terminated in the UNC 152.

The UMA-UMTS control plane is shown in FIG. 6. The basestation 110implements the UMTS RRC, RLC, and MAC sub-layers, where ciphering isimplemented in both RLC and MAC. The UMA-RRC sub-layer contains theadditional UMTS related signaling. The UNC 152 can be extended toinclude an lu interface which connects to the 3G-SGSN. The upper layersGMM, SM, and SMS are contained in the 3G-SGSN and communicate with theirpeers in the UE.

For UMAN-UMTS voice (FIG. 7), the voice traffic is sent through the RLCand MAC sub-layers, where ciphering is performed in MAC. The voicetraffic is transported using RTP/UDP between the basestation 110 and theUNC 152. The UNC 152 routes the voice traffic over lu-CS to the 3G-MSCwhich contains the core network AMR codec.

For the UMAN-UMTS user plane (FIG. 8), IP user-data is transported viathe PDCP, RLC, and MAC sub-layers to the basestation 110. Thebasestation implements the UMTS RLC and MAC sub-layers, where cipheringis implemented in the RLC sub-layer. The PDCP sub-layer might be movedto the basestation, rather than the indicated position in the UNC 152,but this is dependent on the future UNC implementation.

For GERAN ciphering, the ciphering keys and other information elementsneed to be transferred to the basestation 110 from the macro-corenetwork 130, firstly in order that the CIPHERING MODE messages may betransmitted between the basestation 110 and the MS 122, and secondly inorder that the basestation 110 GSM Layer 1 can cipher and de-cipher thesubsequent control and user plane messages. The major requirement, andalteration to the UMAN protocol specification, is the requirement of thevalue of the cipher key Kc at the basestation 110, in order that theciphering and deciphering of the GSM Layer 1 messages can be performedin the basestation. The value of Kc is proposed to be received in anadditional message received from the UNC 152. The following two messagesare therefore proposed as an extension to the standard UMA message set:

Message Name Description Contents URR CIPHERING Request by the None. KEYbasestation for the REQUEST Ciphering Key to be sent by the network tothe basestation. URR CIPHERING Response from the 1. 64-bit GSM cipheringKEY network containing the key Kc. RESPONSE ciphering key. 2. A statusword denoting whether the request was successful or failed.

In the case of a GERAN to UMAN handover, the new value of Kc iscontained in the GERAN A-HANDOVER REQUEST message sent from the MSC tothe UNC 152, which is currently not passed to the MS 122 or basestation110. The ciphering-related contents of the A-HANDOVER REQUEST messagemust be passed to the basestation in order to start ciphering once thehandover is complete (if ciphering is active and enabled afterhandover).

In the case of a UMAN to GERAN handover, the value of Kc has alreadybeen passed to the basestation 110 (via the modified CIPHERING MODECOMMAND messages) during the UMAN ciphering configuration procedure. Thevalue of Kc is passed to the target BSS via the A-HANDOVER REQUESTmessage from the MSC, therefore requiring no further modifications.

The ciphering configuration for GSM is performed as shown in FIG. 9 andas described in the sequence of steps below:

901. The core network 130 sends the BSSAP CIPHER MODE COMMAND to the UNC152, which contains the GSM ciphering key Kc, and the encryptionalgorithm that the UNC (and MS) shall use.

903. The UNC 152 sends the URR-CIPHERING MODE COMMAND to the basestation110, which indicates whether ciphering shall be started or not (afterhandover to GERAN), if so which algorithm to use, and a random numberRAND. The message also indicates whether the MS shall include the IMEIin the URR CIPHERING MODE COMPLETE message.

905. The basestation 110 requests the value of the ciphering key Kc fromthe network by sending the proprietary URR-CIPHERING KEY REQUESTmessage, as described above.

907. The UNC 152 sends the value of the ciphering key in theURR-CIPHERING KEY RESPONSE message, as described above, to thebasestation 110. The value of the ciphering key may only be sent by theUNC 152 if the basestation-UNC connection is encrypted. If thebasestation is not allowed the value of Kc, or the link is notencrypted, or the current request was invalid, the response messageshall contain no ciphering key, with the status set to “Invalidciphering key”, otherwise the status shall be set to “Valid cipheringkey”.

909. The basestation generates and sends the CIPHERING MODE COMMAND tothe MS 122, indicating whether ciphering is enabled or not, and if sowhich algorithm to use. The contents of this message are based on theURR CIPHERING MODE COMMAND.

911. The MS 122 returns the CIPHERING MODE COMPLETE message, optionallycontaining the International Mobile Equipment Identity (IMEI).

913. A Message Authentication Code (MAC) is calculated by thebasestation 110, from the input values of RAND, Kc, IMSI, using theHMAC-SHAI-96 algorithm, and returned together with the IMEI ifindicated, in the URR CIPHERING MODE COMPLETE message.

915. The UNC 152 verifies the MAC. If the UNC verifies the MAC to becorrect it sends the CIPHER MODE COMPLETE message to the core network130.

For UMTS ciphering, the ciphering keys and other information elementsare to be transferred to the basestation from the macro-core network inorder that firstly the SECURITY MODE messages may be transmitted betweenthe basestation and the UE 122, and secondly in order that thebasestation UMTS Layer 2 can cipher and decipher the subsequent controland user plane messages. The major requirement, and alteration to theUMAN protocol specification, is the presence of the values of the UMTSCipher Key CK and the UMTS Integrity Key IK at the basestation, in orderthat the ciphering and de-ciphering can be performed in the basestation.The values of CK and IK is proposed to be received in an additionalmessage received from the UNC.

The following two messages are therefore proposed as extensions to UMA:

Message Name Description Contents URR SECURITY KEY Request by thebasestation None. REQUEST for the Ciphering Key CK and the Integrity KeyIK to be sent by the network to the basestation. URR SECURITY KEYResponse from the network 1. 128-bit UMTS Ciphering RESPONSE containingthe ciphering key Key CK. and the integrity key. 2. 128-bit UMTSIntegrity Key IK. 2. A status word denoting whether the request wassuccessful or failed.

In the case of a UMTS to UMAN handover, the new values of CK and IK arecontained in the lu-RELOCATION REQUEST message sent from the 3G-SGSN tothe UNC, which are currently not passed to the UE or basestation. Theciphering-related contents of the lu-RELOCATION REQUEST message must bepassed to the basestation in order to start ciphering once the handoveris complete (if ciphering is active and enabled after handover).

In the case of a UMAN to UMTS handover, the values of CK and IK havealready been passed to the basestation (via the modified SECURITY MODECOMMAND messages) during the UMAN ciphering configuration procedure. Thevalues of CK and IK are passed to the target RNS via the lu-RELOCATIONREQUEST message from the 3G-SGSN, therefore requiring no furthermodifications.

The UMTS ciphering configuration is performed as shown in FIG. 10 and inthe sequence of steps below:

1001. The core network 130 sends the RANAP SECURITY MODE COMMAND to theUNC 152, which contains the UMTS Ciphering Key CK and the UMTS IntegrityKey IK, and the encryption algorithm(s) that the UNC (and UE) shall use.

1003. The UNC 152 sends the URR-SECURITY MODE COMMAND to the basestation110, which indicates whether ciphering shall be started or not (afterhandover to UMTS), if so which algorithm to use, a random number RAND,and Authentication Token AUTH. The message also indicates whether the UEshall include the IMEI in the URR SECURITY MODE COMPLETE message.

1005. The basestation 110 requests the values of the UMTS Ciphering KeyCK and UMTS Integrity Key IK from the network by sending the proprietaryURR-SECURITY KEY REQUEST message, as described above.

1007. The UNC 152 sends the value of the ciphering key in theURR-SECURITY KEY RESPONSE message, as described above, to thebasestation 110. The value of the ciphering key may only be sent by theUNC if the basestation-UNC connection is encrypted. If the basestationis not allowed the values of CK and IK, or the link is not encrypted, orthe current request was invalid, the response message shall contain nociphering key, with the status set to “Invalid ciphering key”, otherwisethe status shall be set to “Valid ciphering key”.

1009. The basestation 110 generates and sends the SECURITY MODE COMMANDto the UE 122, indicating whether ciphering is enabled or not, and if sowhich algorithm to use. The contents of this message are based on theURR SECURITY MODE COMMAND.

1011. The UE 122 returns the SECURITY MODE COMPLETE message, optionallycontaining the IMEI.

1013. A MAC is calculated by the basestation 110, from the input valuesof RAND, CK, IK, and IMSI, using the HMAC-SHAI-96 algorithm, andreturned together with the IMEI if indicated, in the URR SECURITY MODECOMPLETE.

1015. The UNC 152 verifies the MAC. If the UNC verifies the MAC to becorrect it sends the SECURITY MODE COMPLETE message to the core network130.

The basestation 110 maps all UMA procedures to GSM/UMTS procedures, andvice-versa. This mapping is outlined in the following sub-sections.

Discovery and Registration Procedures

The UMA discovery and registration procedures as shown in FIG. 11 areperformed when a suitable mobile station selects the basestation 110through the GSM/UMTS PLMN selection and cell selection procedures. Themobile station may also be performing a PLMN re-selection which ismapped to the UMA rove-in procedure. The sequence shown in FIG. 11assumes the UE 122 has no active voice or packet sessions active on theGERAN (i.e. in idle mode). The UE 122 may be IMSI and/or GPRS attachedon the GSM or UMTS networks. The discovery and registration procedure isthe same for both GSM and UMTS.

The following sequence of steps is executed:

The UE performs the Location Registration procedure by sending aLOCATION UPDATING REQUEST 1101 over the Um or Uu interface that alsocontains the IMSI of the UE. The basestation may reject the LOCATIONUPDATING REQUEST early by sending a LOCATION UPDATING REJECT 1103 if theUE 122 is not registered with the basestation 110, due to an invalidIMSI.

The basestation 110 performs the UMAN discovery and registrationprocedures 1105 and 1113 in order to inform the UNC that a particular UEis available at a particular basestation. The UNC keeps track of thisinformation for the purposes of providing services (for examplemobile-terminated calls).

If the discovery or registration is rejected by the UNC (messages 1107or 1115), the ZoneGate generates a LOCATION UPDATING REJECT (1109 or1117) and sends it to the mobile.

On successful registration (messages 1111 or 1119), the basestation 110transfers the original LOCATION UPDATING REQUEST to the core networkSGSN (message 1121).

The core network 130 performs the authentication and cipheringprocedures during the Location Registration in order to authenticate theUE 122 with the core network and to set-up the ciphering parametersprior to the commencement of ciphering. The core network indicates asuccessful Location Registration by sending the LOCATION UPDATING ACCEPTmessage 1123 to the UE. The UE has now registered with the core networkand has successfully camped onto the basestation cell.

Deregistration Procedure

The Deregistration procedure is illustrated in FIG. 12. The IMSI DETACH1201 may be originated from the mobile and sent to the basestation 110,where it is mapped to the URR Deregister 1203 and sent to the UNC. TheURR DEREGISTER message 1205 may also be originated from the UNC and sentto the basestation 110, where it is mapped to the IMSI DETACH 1207,which is sent from the basestation to the mobile 122. The deregistrationprocedure is the same for both GSM and UMTS.

Mobile Originated Speech Call Procedure The mobile originated speechcall procedure shown in FIG. 13 implements the standard GSM signallingbetween the basestation and the MS 122, which are mapped to the UMAdefined signalling. The contents of the messages are as defined in theUMA and 3GPP specifications, and are therefore not explained in thisdocument. The procedure is similar for both GSM and UMTS.

The sequence of steps illustrated In FIG. 13 is detailed below:

The CM Service Request 1301 is sent from the mobile 122 to the UNC 152via the uplink direct transfer wrapper 1303.

Authentication is performed transparently with the uplink and downlinkdirect transfer messages 1305, 1307, 1309, 1311.

For GSM, the URR Ciphering Mode Command 1313 is sent from the UNC 152 tothe basestation 110, which maps it on to the Ciphering Mode Command 1315sent from the basestation to the mobile 122. The Ciphering Mode Completemessage 1317 is sent from the mobile 122 to the basestation 110, whichmaps it on to the URR Ciphering Mode Complete message 1319. For UMTS theSecurity Mode messages 1321, 1323, 1325, 1327 replace the Ciphering Modemessages 1313, 1315, 1317, 1319.

The CM Service Accept 1331 is sent from the UNC 152 to the basestationin the URR downlink direct transfer wrapper message 1329, and forwardedby the basestation to the mobile 122.

The Setup message 1333 is sent from the mobile 122 to the basestation,which is forwarded to the UNC in the uplink direct transfer message1335. The Call Proceeding message 1339 is sent from the UNC to thebasestation in the downlink direct transfer wrapper message 1337, andforwarded by the basestation to the mobile.

The URR Activate Channel message 1341, 1349 is sent by the UNC 152 tothe basestation 110, which is mapped to the Channel Mode Modify message1343 for GSM, or the Radio Bearer Reconfiguration message 1351 for UMTS,and sent to the mobile. The Channel Mode Modify Acknowledge message 1345is sent from the mobile to the basestation for GSM, or the Radio BearerReconfiguration Complete message 1353 for UMTS, and mapped to the URRActivate Channel Ack message 1347, 1355 and sent from the basestation110 to the UNC.

The Alerting and Connect messages 1361, 1365 are sent from the UNC 152to the basestation in the URR downlink direct transfer wrapper messages1359, 1363, and forwarded by the basestation to the mobile. The ConnectAcknowledge message 1367 is sent from the mobile to the basestation, andforwarded in the URR uplink transfer message 1369 to the UNC to completethe mobile originated call setup procedure.

Mobile Terminated Speech Call Procedure

The mobile terminated speech call procedure illustrated in FIG. 14implements the standard GSM signalling between the basestation and theMS/UE 122, which are mapped to the UMA defined signalling. The contentsof the messages are as defined in the UMA and 3GPP specifications, andare therefore not explained in this document. The procedure is similarfor both GSM and UMTS.

The message interchange shown in FIG. 14 is described in the sequence ofsteps below:

The URR PAGING REQUEST 1401 is sent from the UNC to the basestation inorder to start the mobile-terminated speech call. The PAGING REQUEST1403 is generated by the basestation and transmitted to the MS/UE. TheMS PAGING RESPONSE message 1405 is received by the basestation whichgenerates and sends the URR PAGING RESPONSE 1407 to the UNC. For UMTSthe PAGING TYPE 1 message 1411 is generated by the basestation to the UEwhich responds with the CELL UPDATE procedure 1413.

The UNC performs the authentication procedures with the downlink anduplink direct transfer messages 1419, 1421, 1423, 1425, and theciphering procedures with the CIPHERING MODE COMMAND and CIPHERING MODECOMPLETE messages 1427, 1429, 1431, 1433 for GSM, or the SECURITY MODEmessages 1435, 1437, 1439, 1441 for UMTS.

The remainder of the call setup procedure is performed transparently bythe UNC transmission and reception of the downlink and uplink directtransfer messages. The basestation 110 coverts each uplink and downlinkmessage into the required air-interface SETUP (1443-1445), CALLCONFIRMED (1447-1449), ALERTING (1451-1453), CONNECT (1455-1457), andCONNECT ACKNOWLEDGE (1459-1461) messages.

URLC Transport Channel Activation Procedure

The URLC Transport Channel activation procedures shown in FIG. 15 areUMA-defined procedures, which are mapped onto the GPRS air-interface PDPContext Activation procedures. The contents of the messages are asdefined in the UMA and 3GPP specifications, and are therefore notexplained in this document. The Transport Channel activation proceduresare the same for both GSM and UMTS.

The message interchange shown in FIG. 15 is summarised in the sequenceof steps below:

The activation of the URLC transport channel may be activated by the UEby initiating the PDP Context Activation procedure. The ACTIVATE PDPCONTEXT REQUEST 1501 is mapped to the URLC ACTIVATE UTC REQ message1503, and the URLC ACTIVATE UTC ACK 1505 received from the UNC is mappedto the ACTIVATE PDP CONTEXT ACCEPT message 1507. If the URLC ACTIVATEUTC ACK 1505 contains a negative acknowledgement, the ACTIVATE PDPCONTEXT REJECT message 1509 is generated instead of the accept message.

The activation of the URLC transport channel may be activated by the UNCby sending the URLC ACTIVATE UTC REQ 1511. This message is mapped to theREQUEST PDP CONTEXT ACTIVATION message 1513 and sent to the UE. The UEin response generates the ACTIVATE PDP CONTEXT REQUEST message 1515,which the basestation maps to both the URLC ACTIVATE UTC ACK 1517 andACTIVATE PDP CONTEXT ACCEPT 1519 messages. In this case the ZAP decideswhether the PDP Context Activation procedure is successful, andgenerates the ACTIVATE PDP CONTEXT REJECT message 1521 if not.

URLC Transport Channel Deactivation Procedure

The URLC Transport Channel deactivation procedures shown in FIG. 16 areUMA-defined procedures, which are mapped onto the GPRS air-interface PDPContext Deactivation procedures. The contents of the messages are asdefined in the UMA and 3GPP specifications, and are therefore notexplained in this document. The Transport Channel deactivationprocedures are the same for both GSM and UMTS.

The message interchange shown in FIG. 16 is summarised in the sequenceof steps below.

The deactivation of the URLC transport channel may be initiated by theUE or the network.

The UE initiates the URLC transport channel deactivation by sending theDEACTIVATE PDP CONTEXT REQUEST message 1601 to the basestation, whichgenerates and sends the URLC DEACTIVATE UTC REQ message 1603 to the UNC152. The UNC 152 replies with the URLC DEACTIVATE UTC ACK message 1607which is mapped by the basestation to the DEACTIVATE PDP CONTEXT ACCEPT1605 and sent to the MS.

The network initiates the URLC transport channel deactivation by sendingthe URLC DEACTIVATE UTC REQ message 1609 to the basestation, whichgenerates and sends the DEACTIVATE PDP CONTEXT REQUEST message 1611 tothe UE. The UE replies with the DEACTIVATE PDP CONTEXT ACCEPT message1613 which is mapped by the basestation to the URLC DEACTIVATE UTC ACK1615 and sent to the UNC.

Paging Procedures

The paging procedures shown in FIG. 17 comprise the packet pagingprocedure for packet-switched services, and the normal paging procedurefor circuit-switched services. Both paging procedures are alwaysinitiated by the network. The contents of the messages are as defined inthe UMA and 3GPP specifications, and are therefore not explained in thisdocument.

The message interchange shown in FIG. 17 is summarised in the sequenceof steps below.

The packet paging procedure is initiated by the network by sending theURLC PS PAGE message 1701 from the UNC to the basestation, which ismapped to the PAGING REQUEST 1703 and sent to the MS. The MS responds bysending any LLC UNITDATA or DATA packet 1705 to the basestation whichmaps the message to the URLC UNITDATA or DATA message 1707.

The circuit-switched paging procedure is initiated by the network bysending the URR PAGING REQUEST message 1709 from the UNC to thebasestation, which is mapped to the PAGING REQUEST 1711 and sent to theMS. The MS responds by sending the PAGING RESPONSE 1713 to thebasestation which maps the message to the URR PAGING RESPONSE message1715 and sends it to the UNC.

The UMTS paging procedure is initiated by the network by sending the URRPAGING REQUEST message 1717 from the UNC to the basestation, which ismapped to the PAGING TYPE 1 message 1719 and sent to the UE. The UEresponds by sending the CELL UPDATE 1721 to the basestation whichresponds with the CELL UPDATE CONFIRM 1725, and maps the message to theURR PAGING RESPONSE message 1723 and sends it to the UNC.

GERAN to UMAN Handover Procedure

The GERAN to UMAN sequence shown in FIG. 18 assumes that the MS has anactive voice call on the GERAN. The following steps are followed. Notethat the network element signalling between the UNC and MSC, and betweenthe BSS and MSC are shown for clarification purposes only. The contentsof all the messages shown are as defined in the UMA and 3GPPspecifications, and are therefore not explained in this document.

The message interchange shown in FIG. 18 is summarised in the stepsbelow.

The MS sends MEASUREMENT REPORTs 1801, 1803, 1805 etc on a continualbasis to the BSS containing the {ARFCN, BSIC} of the surrounding cells.The basestation 110 {ARFCN, BSIC} will be included in the measurementreports if the basestation transmitted BCCH carrier power is sufficientand/or the basestation ARFCN is transmitted in the BSC BA list(contained in the SYSTEM INFORMATION transmitted by the BSS BCCH servingcell).

The basestation 110 should be reported by the MS as having the highestsignal level compared to the serving and neighbouring GERAN cells.

The BSS internally maps the basestation 110 {ARFCN, BSIC} to a UMA cellCGI. The GERAN decides to handover to the UMA cell by sending a HANDOVERREQUIRED message 1807 to the core network 130 MSC.

The core network 130 requests the target UNC 152 to allocate resourcesfor the handover using the HANDOVER REQUEST message 1809. The UNC 152should map the IMSI contained in the HANDOVER REQUEST 1809 to the MSuser's home basestation 110. The target home basestation 110 may or maynot be the basestation 110 seen currently by the MS.

The target UNC 152 acknowledges the request, using the HANDOVER REQUESTACKNOWLEDGE 1811, indicating it can support the requested handover,which also contains the HANDOVER COMMAND contents indicating the homebasestation 110 radio channel parameters to which the MS should bedirected.

The core network 130 forwards the HANDOVER COMMAND 1813 to the GERAN,completing the handover preparation.

The GERAN sends the HANDOVER COMMAND 1815 to the MS to indicate ahandover to the basestation. The HANDOVER COMMAND 1815 contains theARFCN, PLMN colour code and BSIC of the target basestation 110. The MSdoes not switch its audio path from GERAN to UMAN until handovercompletion.

The MS accesses the basestation 110 using the HANDOVER ACCESS message1817. The handover reference contained in the HANDOVER ACCESS message1817 is passed to the UNC in the URR HANDOVER ACCESS message 1819, whichallows the serving UNC to correlate the handover to the HANDOVER REQUESTACKNOWLEDGE message 1811.

The serving UNC 152 sets up the bearer path with the basestation and MS.

The basestation 110 transmits the URR HANDOVER COMPLETE message 1827 toindicate the completion of the handover procedure. The MS switches fromthe GERAN user plane to the UMAN user plane.

Bi-directional voice traffic 1831, 1833, 1835 starts to flow between theMS 122 and core network 130 via the serving UNC 152.

The target UNC indicates the handover is complete, using the HANDOVERCOMPLETE message 1837. If not already done so, the core network switchesthe user plane from the source GERAN to the target UMAN.

As required, subsequently, the core network 130 tears down theconnection to the source GERAN using the CLEAR COMMAND 1839.

The source GERAN confirms the release of GERAN resources allocated forthis call, using CLEAR COMPLETE 1845.

UMAN to GERAN Handover Procedure

The UMAN to GERAN sequence shown in FIG. 19 assumes that the MS has anactive voice call on the UMAN. The MS begins to leave coverage of thebasestation 110 in accordance with the invention. The following stepsare followed. Note that the network element signalling between the UNCand MSC, and between the BSS and MSC are shown for clarificationpurposes only. The contents of all the messages shown are as defined inthe UMA and 3GPP specifications, and are therefore not explained in thisdocument.

The message sequence shown in FIG. 19 is summarised in the sequence ofsteps below.

The handover from UMAN to GERAN is triggered by the MS measurementreports 1901, 1905 of the surrounding GERAN {ARFCN, BSIC} BCCH-carrierpower levels. The UNC may send an optional URR UPLINK QUALITY INDICATION1903 based on signal strength criterion.

The basestation 110 detects that a handover is required, and sends theURR HANDOVER REQUIRED message 1907 to the serving UNC 152 indicating theChannel Mode and a list of GERAN cells, identified by CGI in order ofpreference for handover. The basestation 110 may obtain the list of CGIsby decoding the System Information messages in the surrounding GERANcells itself, or may obtain a list of CGIs (and their correspondingARFCN, BSICs) by accessing an appropriate database in relation to itsactual geographical position (by postcode or other geographicalpositioning device).

The serving UNC starts the handover preparation by signalling to thecore network 130 using the HANDOVER REQUIRED message 1909.

The core network selects a target GERAN cell and requests it to allocatethe necessary resources, using HANDOVER REQUEST 1911.

The target GERAN builds a HANDOVER COMMAND message providing informationon the channel allocated and sends it to the core network through theHANDOVER REQUEST ACKNOWLEDGE message 1913.

The core network signals the serving UNC to handover the MS to theGERAN, using the HANDOVER COMMAND message 1915, ending the handoverpreparation phase.

The serving UNC transmits the URR HANDOVER COMMAND 1917 to thebasestation 110 including details sent by the GERAN on the targetresource allocation. The basestation 110 transmits the HANDOVER COMMAND1919 to the MS 122 indicating the MS should handover to the GERAN cell.

The MS transmits the HANDOVER ACCESS command 1921 containing thehandover reference parameter to allow the target GERAN to correlate thishandover access with the HANDOVER COMMAND message transmitted earlier tothe core network in response to the HANDOVER REQUIRED.

The target GERAN confirms the detection of the handover to the corenetwork, using the HANDOVER DETECT message 1923.

The core network may at this point switch the user plane to the targetBSS. The GERAN provides PHYSICAL INFORMATION 1927 to the MS i.e. timingadvance, to allow the MS to synchronise with the GERAN.

The MS signals to the GERAN that the handover is completed, using theHANDOVER COMPLETE 1929.

The GERAN confirms to the core network the completion of the handover,using the HANDOVER COMPLETE message 1931. If the user plane has notalready been switched, the core network switches the user plane to thetarget BSS.

Bi-directional voice traffic 1933, 1935 is now flowing between the MSand core network via the GERAN.

The core network indicates to the serving UNC to release any resourcesallocated to the MS using the CLEAR COMMAND 1937.

The serving UNC commands the basestation 110 to release resources usingthe URR RR RELEASE message 1939.

The serving UNC confirms resource release to the core network using theCLEAR COMPLETE message 1941.

The basestation 110 confirms resource release to the serving UNC usingthe URR RR RELEASE COMPLETE message 1943.

The basestation 110 may finally deregister from the serving UNC usingthe URR DEREGISTER message 1945.

Inter-RAT UMTS to UMAN-GERAN Handover Procedure

The UMTS to UMAN-GERAN sequence shown in FIG. 20 assumes that the MS hasan active voice call on the UMTS network. It is possible to generate ahandover between a UMTS macro-network and a GERAN-only enabled UNC andZoneGate through an Inter-RAT (Radio Access Technology) handoverprocedure. The following steps are followed. Note that the networkelement signalling between the UNC and MSC, and between the BSS and MSCare shown for clarification purposes only. The contents of all themessages shown are as defined in the UMA and 3GPP specifications, andare therefore not explained in this document.

The message interchange shown in FIG. 20 is summarised in the sequenceof steps below.

The MS 122 sends MEASUREMENT REPORTs 2001, 2003, 2005 on a continualbasis to the RNS Node-B base-station containing the {Primary ScramblingCode, UARFCN, Cell Identity} of the surrounding UMTS cells, and the{ARFCN, BSIC} of the surrounding GERAN cells if the MS has been directedto monitor surrounding GERAN cells in the “inter-RAT cell info” part ofthe CELL_INFO_LIST variable. The basestation 110 {ARFCN, BSIC} will beincluded in the measurement reports if the basestation transmitted BCCHcarrier power is sufficient if such inter-RAT measurements are enabled.

The basestation 110 should be reported by the MS as having the highestsignal level compared to the serving and neighbouring UMTS cells.

The RNS internally maps the basestation 110 {ARFCN, BSIC} to a UMA cellCGI. The UMTS network decides to handover to the UMA cell by sending aRELOCATION REQUIRED message 2007 to the core network 3G-MSC.

The core network requests the target UNC to allocate resources for thehandover using the HANDOVER REQUEST message 2009. The UNC should map theIMSI contained in the HANDOVER REQUEST to the MS user's home basestation110. The target home basestation 110 may or may not be the basestation110 seen currently by the MS.

The target UNC acknowledges the request, using the HANDOVER REQUESTACKNOWLEDGE 2011, indicating it can support the requested handover,which also contains the HANDOVER COMMAND contents indicating the homebasestation radio channel parameters to which the MS should be directed.

The core network 3G-MSC forwards the RELOCATION COMMAND 2013 to the RNS,completing the handover preparation.

The UMTS network sends the HANDOVER FROM UTRAN COMMAND 2015 to the MS toindicate a handover towards the basestation 110. The HANDOVER FROM UTRANCOMMAND 2015 contains the ARFCN, PLMN colour code and BSIC of the targetbasestation 110. The MS does not switch its audio path from UMTS to UMANuntil handover completion.

The MS accesses the basestation using the HANDOVER ACCESS message 2017.

The handover reference contained in the HANDOVER ACCESS message 2017 ispassed to the UNA in the URR HANDOVER ACCESS message 2019, which allowsthe serving UNC to correlate the handover to the HANDOVER REQUESTACKNOWLEDGE message 2011.

The serving UNC sets up the bearer path with the basestation 110 and MS.

The basestation 110 transmits the URR HANDOVER COMPLETE message 2027 toindicate the completion of the handover procedure. The MS switches fromthe UMTS user plane to the UMAN user plane.

Bi-directional voice traffic 2031, 2033, 2035 is flowing between the MSand core network via the serving UNC.

The target UNC indicates the handover is complete, using the HANDOVERCOMPLETE message 2037. If not already done so, the core network switchesthe user plane from the source UMTS to the target UMAN.

The core network tears down the connection to the source UMTS networkusing the RELEASE COMMAND 2039.

The source UMTS network confirms the release of resources allocated forthis call, using RELEASE COMPLETE 2041.

Inter-RAT UMAN-GERAN to UMTS Handover Procedure

The Inter-RAT UMAN-GERAN to UMTS handover sequence shown in FIG. 21assumes that the MS has an active voice call on the UMAN-enabledbasestation network. It is possible to generate a handover between aGERAN-only UMAN-enabled basestation and a UMTS macro-network through theInter-RAT handover procedure. The following steps are followed. Notethat the network element signalling between the UNC and MSC, and betweenthe BSS and MSC are shown for clarification purposes only. The contentsof all the messages shown are as defined in the UMA and 3GPPspecifications, and are therefore not explained in this document.

The message interchange shown in FIG. 21 is summarised in the stepsbelow. The inter-RAT handover from UMAN to the UMTS macro-network istriggered by the MS measurement reports 2101, 2105 of the surroundingmacro-network UMTS {ARFCN, BSIC} BCCH-carrier power levels. The UNC maysend an optional URR UPLINK QUALITY INDICATION 2103 based on signalstrength criterion.

The basestation 110 detects that a handover is required, and sends theURR HANDOVER REQUIRED message 2107 to the serving UNC indicating theChannel Mode and a list of GERAN cells, identified by CGI in order ofpreference for handover. The basestation 110 may obtain the list of CGIsby decoding the System Information messages in the surrounding GERANcells itself, or may obtain a list of CGIs (and their correspondingARFCN, BSICs) by accessing an appropriate database in relation to itsactual geographical position (by postcode or other geographicalpositioning device).

The serving UNC starts the handover preparation by signalling to thecore network using the HANDOVER REQUIRED message 2109.

The core network selects a target UMTS cell and requests it to allocatethe necessary resources, using RELOCATION REQUEST 2111.

The target UMTS RNS builds a HANDOVER COMMAND message providinginformation on the channel allocated and sends it to the core networkthrough the RELOCATION REQUEST ACKNOWLEDGE message 2113.

The core network signals the serving UNC to handover the MS to the UMTSnetwork, using the HANDOVER COMMAND message 2115, ending the handoverpreparation phase.

The serving UNC transmits the URR HANDOVER COMMAND 2117 to thebasestation 110 including details sent by the UMTS network on the targetresource allocation. The basestation 110 transmits the HANDOVER TO UTRANCOMMAND 2119 to the MS indicating the MS should handover to the UMTScell.

The MS is detected by the target UMTS network RNS due to lower layertransmissions from the MS. The target RNS confirms the detection of thehandover to the core network, using the RELOCATION DETECT message 2121.

The core network may at this point switch the user plane to the targetRNS.

Once the MS is synchronised with the UMTS RNS, the MS signals that thehandover is completed, using the HANDOVER COMPLETE 2125.

The UMTS RNS confirms to the core network the completion of thehandover, using the RELOCATION COMPLETE message 2127. If the user planehas not already been switched, the core network switches the user planeto the target RNS.

Bi-directional user-plane traffic 2129, 2131 is now flowing between theMS and core network via the UMTS core network.

The core network indicates to the serving UNC to release any resourcesallocated to the MS using the CLEAR COMMAND 2133.

The serving UNC commands the basestation 110 to release resources suingthe URR RR RELEASE message 2135.

The serving UNC confirms resource release to the core network using theCLEAR COMPLETE message 2137.

The basestation 110 confirms resource release to the serving UNC usingthe URR RR RELEASE COMPLETE message 2139.

The basestation 110 may finally deregister from the serving UNC usingthe URR DEREGISTER message 2141.

UMTS to UMAN-UMTS Handover

The UMTS to UMAN-UMTS sequence shown in FIG. 22 assumes that the UE hasan active voice call on the UMTS network. The following steps arefollowed.

The UE sends MEASUREMENT REPORTs 2201, 2203 on a continual basis to theRNS Node-B base-station containing the {Primary Scrambling Code, UARFCN,Cell Identity} of the surrounding UMTS cells.

The basestation 110 should be reported by the UE as having the highestsignal level compared to the serving and neighbouring UMTS cells.

The RNS internally maps the basestation 110 {Primary Scrambling Code,UARFCN, Cell Identity} to a UMA cell CGI. The UMTS network decides tohandover to the UMA cell by sending a RELOCATION REQUIRED message 2205to the core network 3G-MSC.

The core network requests the target UNC to allocate resources for thehandover using the RELOCATION REQUEST message 2207. The UNC should mapthe IMSI contained in the RELOCATION REQUEST 2207 to the UE user's homebasestation 110. The target home basestation may or may not be thebasestation 110 seen currently by the UE.

The target UNC acknowledges the request, using the RELOCATION REQUESTACKNOWLEDGE 2209, indicating it can support the requested handover,which also contains the RELOCATION COMMAND contents indicating the homebasestation radio channel parameters to which the UE should be directed.

The core network 3G-MSC forwards the RELOCATION COMMAND 2211 to the RNS,completing the handover preparation.

The UMTS network sends the PHYSICAL CHANNEL RECONFIGURATION 2213 to theUE to indicate a handover towards the basestation. The PHYSICAL CHANNELRECONFIGURATION contains the physical channel information of the targetbasestation. The UE does not switch its audio path from UMTS to UMANuntil handover completion.

The UE is detected by the basestation 110 through Layer 1synchronisation and Layer 2 link establishment. The URR HANDOVER ACCESSmessage 2215 is transmitted from the basestation to the UNC, whichallows the serving UNC to correlate the handover to the RELOCATIONREQUEST ACKNOWLEDGE message.

The serving UNC sets up the bearer path with the basestation 110 and UE.

On reception of the PHYSICAL CHANNEL RECONFIGURATION COMPLETE 2219 fromthe UE, the basestation transmits the URR HANDOVER COMPLETE message 2221to indicate the completion of the handover procedure. The UNC transmitsthe RELOCATION DETECT 2223 to the MSC.

The UE switches from the UMTS user plane to the UMAN user plane.Bi-directional voice and/or data traffic 2225, 2227, 2229 is flowingbetween the UE and core network via the serving UNC.

The target UNC indicates the handover is complete, using the RELOCATIONCOMPLETE message 2231. If not already done so, the core network switchesthe user plane from the source UMTS to the target UMAN.

The core network tears down the connection to the source UMTS networkusing the RELEASE COMMAND 2235.

The source UMTS network confirms the release of resources allocated forthis call, using RELEASE COMPLETE 2237.

UMAN-UMTS to UMTS Handover

The UMAN-UMTS to UMTS sequence shown in FIG. 23 assumes that the UE hasan active voice or data call on the UMAN in UMTS mode. The UE begins toleave coverage of the basestation 110. The following steps are followed.

The message interchange shown in FIG. 23 is summarised in the stepsbelow:

The handover from UMAN to the UMTS macro-network is triggered by the UEmeasurement reports 2301, 2305 of the surrounding macro-network UMTS{Primary Scrambling Code, UARFCN, Cell Identity} BCCH-carrier powerlevels. The UNC may send an optional URR UPLINK QUALITY INDICATION 2303based on signal strength criterion.

The basestation 110 detects that a handover is required, and sends theURR HANDOVER REQUIRED message 2307 to the serving UNC indicating thelist of surrounding UMTS cells, identified by CGI in order of preferencefor handover. The basestation 110 may obtain the list of CGIs bydecoding the System Information messages in the surrounding UMTS cellsitself, or may obtain a list of CGIs (and their corresponding UARFCN,Primary Scrambling Codes) by accessing an appropriate database inrelation to its actual geographical position (by postcode or othergeographical positioning device).

The serving UNC starts the handover preparation by signalling to thecore network using the RELOCATION REQUIRED message 2309.

The core network selects a target UMTS cell and requests it to allocatethe necessary resources, using RELOCATION REQUEST 2311.

The target UMTS RNS builds a RELOCATION COMMAND message providinginformation on the channel allocated and sends it to the core networkthrough the RELOCATION REQUEST ACKNOWLEDGE message 2313.

The core network signals the serving UNC to handover the UE to the UMTSnetwork, using the RELOCATION COMMAND message 2315, ending the handoverpreparation phase.

The serving UNC transmits the URR HANDOVER COMMAND 2317 to thebasestation 110 including details sent by the UMTS network on the targetresource allocation. The basestation 110 transmits the PHYSICAL CHANNELRECONFIGURATION 2319 to the UE indicating the UE should handover to theUMTS cell.

The UE is detected by the target UMTS network RNS due to lower layertransmissions from the UE. The target RNS confirms the detection of thehandover to the core network, using the RELOCATION DETECT message 2321.

The core network may at this point switch the user plane to the targetRNS.

Once the UE is synchronised with the UMTS RNS, the UE signals that thehandover is completed, using the PHYSICAL CHANNEL RECONFIGURATIONCOMPLETE 2325.

The UMTS RNS confirms to the core network the completion of thehandover, using the RELOCATION COMPLETE message 2327. If the user planehas not already been switched, the core network switches the user planeto the target RNS.

Bi-directional user-plane traffic 2329, 2331 is now flowing between theUE and core network via the UMTS core network.

The core network indicates to the serving UNC to release any resourcesallocated to the UE using the RELEASE COMMAND 2333.

The serving UNC commands the basestation to release resources suing theURR RR RELEASE message 2335.

The serving UNC confirms resource release to the core network using theRELEASE COMPLETE message 2337.

The basestation confirms resource release to the serving UNC using theURR RR RELEASE COMPLETE message 2339.

The basestation 110 may finally deregister from the serving UNC usingthe URR DEREGISTER message 2341.

Inter-RAT GERAN to UMAN-UMTS Handover

The GERAN to UMAN-UMTS sequence shown in FIG. 24 assumes that the UE hasan active voice call on the GERAN. The following steps are followed.

The multiband UE sends MEASUREMENT REPORTs 2401, 2403, 2405 on acontinual basis to the BSS containing the {ARFCN, BSIC} of thesurrounding GERAN cells, and the {Primary Scrambling Code, UARFCN, CellIdentity} of the surrounding UMTS cells.

The basestation 110 should be reported by the UE as having the highestsignal level compared to the serving and neighbouring GERAN cells.

The BSS internally maps the basestation 110 {Primary Scrambling Code,UARFCN, Cell Identity} to a UMA cell CGI. The GERAN decides to handoverto the UMA cell by sending a HANDOVER REQUIRED message 2407 to the corenetwork MSC.

The core network requests the target UNC to allocate resources for thehandover using the RELOCATION REQUEST message 2409. The UNC should mapthe IMSI contained in the RELOCATION REQUEST to the UE user's homebasestation 110. The target home basestation 110 may or may not be thebasestation 110 seen currently by the UE.

The target UNC acknowledges the request, using the RELOCATION REQUESTACKNOWLEDGE 2411, indicating it can support the requested handover,which also contains the HANDOVER COMMAND contents indicating the homebasestation radio channel parameters to which the UE should be directed.

The core network forwards the HANDOVER COMMAND 2413 to the GERAN,completing the handover preparation.

The GERAN sends the HANDOVER TO UTRAN COMMAND 2415 to the UE to indicatea handover to the basestation 110. The HANDOVER TO UTRAN COMMANDcontains the UARFCN and primary scrambling code of the targetbasestation 110. The UE does not switch its audio path from GERAN toUMAN until handover completion.

The UE accesses the basestation 110 using the HANDOVER TO UTRAN COMPLETEmessage 2417. The handover reference contained in the message is passedto the UNC in the URR HANDOVER ACCESS message 2419, which allows theserving UNC to correlate the handover to the RELOCATION REQUESTACKNOWLEDGE message.

The serving UNC sets up the bearer path with the basestation 110 and UE.

The basestation transmits the URR HANDOVER COMPLETE message 2423 toindicate the completion of the handover procedure. The UE switches fromthe GERAN user plane to the UMAN user plane.

Bi-directional voice and/or data traffic 2427, 2429, 2431 is flowingbetween the UE and core network via the serving UNC.

The target UNC indicates the handover is complete, using the RELOCATIONCOMPLETE message 2433. If not already done so, the core network switchesthe user plane from the source GERAN to the target UMAN.

The core network tears down the connection to the source GERAN using theCLEAR COMMAND 2435.

The source GERAN confirms the release of GERAN resources allocated forthis call, using CLEAR COMPLETE 2441.

UMTS to UMAN-UMTS Handover

The UMTS to UMAN-UMTS sequence shown in FIG. 25 assumes that the UE hasan active voice call on the UMTS network. The following steps arefollowed.

The UE sends MEASUREMENT REPORTs 2501, 2503 on a continual basis to theRNS Node-B base-station containing the {Primary Scrambling Code, UARFCN,Cell Identity} of the surrounding UMTS cells.

The basestation 110 should be reported by the UE as having the highestsignal level compared to the serving and neighbouring UMTS cells.

The RNS internally maps the basestation 110 {Primary Scrambling Code,UARFCN, Cell Identity} to a UMA cell CGI. The UMTS network decides tohandover to the UMA cell by sending a RELOCATION REQUIRED message 2505to the core network 3G-MSC.

The core network requests the target UNC to allocate resources for thehandover using the RELOCATION REQUEST message 2507. The UNC should mapthe IMSI contained in the RELOCATION REQUEST to the UE user's homebasestation 110.

The target home basestation 110 may or may not be the basestation 110seen currently by the UE.

The target UNC acknowledges the request, using the RELOCATION REQUESTACKNOWLEDGE 2509, indicating it can support the requested handover,which also contains the RELOCATION COMMAND contents indicating the homebasestation radio channel parameters to which the UE should be directed.

The core network 3G-MSC forwards the RELOCATION COMMAND 2511 to the RNS,completing the handover preparation.

The UMTS network sends the PHYSICAL CHANNEL RECONFIGURATION 2513 to theUE to indicate a handover towards the basestation 110. The PHYSICALCHANNEL RECONFIGURATION 2513 contains the physical channel informationof the target basestation. The UE does not switch its audio path fromUMTS to UMAN until handover completion.

The UE is detected by the basestation 110 through Layer 1synchronisation and Layer 2 link establishment. The URR HANDOVER ACCESSmessage 2515 is transmitted from the basestation to the UNC, whichallows the serving UNC to correlate the handover to the RELOCATIONREQUEST ACKNOWLEDGE message.

The serving UNC sets up the bearer path with the basestation 110 and UE.

On reception of the PHYSICAL CHANNEL RECONFIGURATION COMPLETE 2519 fromthe UE, the basestation transmits the URR HANDOVER COMPLETE message 2521to indicate the completion of the handover procedure. The UNC transmitsthe RELOCATION DETECT 2523 to the MSC.

The UE switches from the UMTS user plane to the UMAN user plane.Bi-directional voice and/or data traffic 2525, 2527, 2529 is flowingbetween the UE and core network via the serving UNC.

The target UNC indicates the handover is complete, using the RELOCATIONCOMPLETE message 2531. If not already done so, the core network switchesthe user plane from the source UMTS to the target UMAN.

The core network tears down the connection to the source UMTS networkusing the RELEASE COMMAND 2533.

The source UMTS network confirms the release of resources allocated forthis call, using RELEASE COMPLETE 2535.

UMAN-UMTS to UMTS Handover

The UMAN-UMTS to UMTS sequence shown in FIG. 26 assumes that the UE hasan active voice or data call on the UMAN in UMTS mode. The UE begins toleave coverage of the basestation 110. The message interchange shown inFIG. 26 is summarised in the sequence of steps below:

The handover from UMAN to the UMTS macro-network is triggered by the UEmeasurement reports 2601, 2605 of the surrounding macro-network UMTS{Primary Scrambling Code, UARFCN, Cell Identity} BCCH-carrier powerlevels. The UNC may send an optional URR UPLINK QUALITY INDICATION 2603based on signal strength criterion.

The basestation 110 detects that a handover is required, and sends theURR HANDOVER REQUIRED message 2607 to the serving UNC indicating thelist of surrounding UMTS cells, identified by CGI in order of preferencefor handover. The basestation may obtain the list of CGIs by decodingthe System Information messages in the surrounding UMTS cells itself, ormay obtain a list of CGIs (and their corresponding UARFCN, PrimaryScrambling Codes) by accessing an appropriate database in relation toits actual geographical position (by postcode or other geographicalpositioning device).

The serving UNC starts the handover preparation by signalling to thecore network using the RELOCATION REQUIRED message 2609.

The core network selects a target UMTS cell and requests it to allocatethe necessary resources, using RELOCATION REQUEST 2611.

The target UMTS RNS builds a RELOCATION COMMAND message providinginformation on the channel allocated and sends it to the core networkthrough the RELOCATION REQUEST ACKNOWLEDGE message 2613.

The core network signals the serving UNC to handover the UE to the UMTSnetwork, using the RELOCATION COMMAND message 2615, ending the handoverpreparation phase.

The serving UNC transmits the URR HANDOVER COMMAND 2617 to thebasestation 110 including details sent by the UMTS network on the targetresource allocation. The basestation 110 transmits the PHYSICAL CHANNELRECONFIGURATION 2619 to the UE indicating the UE should handover to theUMTS cell.

The UE is detected by the target UMTS network RNS due to lower layertransmissions from the UE. The target RNS confirms the detection of thehandover to the core network, using the RELOCATION DETECT message 2621.

The core network may at this point switch the user plane to the targetRNS.

Once the UE is synchronised with the UMTS RNS, the UE signals that thehandover is completed, using the PHYSICAL CHANNEL RECONFIGURATIONCOMPLETE 2625.

The UMTS RNS confirms to the core network the completion of thehandover, using the RELOCATION COMPLETE message 2627. If the user planehas not already been switched, the core network switches the user planeto the target RNS.

Bi-directional user-plane traffic 2629, 2631 is now flowing between theUE and core network via the UMTS core network.

The core network indicates to the serving UNC to release any resourcesallocated to the UE using the RELEASE COMMAND 2633.

The serving UNC commands the basestation 110 to release resources suingthe URR RR RELEASE message 2635.

The serving UNC confirms resource release to the core network using theRELEASE COMPLETE message 2637.

The basestation 110 confirms resource release to the serving UNC usingthe URR RR RELEASE COMPLETE message 2639.

The basestation 110 may finally deregister from the serving UNC usingthe URR DEREGISTER message 2641.

Inter-RAT GERAN to UMAN-UMTS Handover

The GERAN to UMAN-UMTS sequence shown in FIG. 27 assumes that the UE hasan active voice call on the GERAN. The message interchange shown in FIG.27 is summarised in the following sequence of steps:

The multiband UE sends MEASUREMENT REPORTs 2701, 2703, 2705 on acontinual basis to the BSS containing the {ARFCN, BSIC} of thesurrounding GERAN cells, and the {Primary Scrambling Code, UARFCN, CellIdentity} or the surrounding UMTS cells.

The basestation 110 should be reported by the UE as having the highestsignal level compared to the serving and neighbouring GERAN cells.

The BSS internally maps the basestation 110 {Primary Scrambling Code,UARFCN, Cell Identity} to a UMA cell CGI. The GERAN decides to handoverto the UMA cell by sending a HANDOVER REQUIRED message 2707 to the corenetwork MSC.

The core network requests the target UNC to allocate resources for thehandover using the RELOCATION REQUEST message 2709. The UNC should mapthe IMSI contained in the RELOCATION REQUEST to the UE user's homebasestation 110.

The target home basestation 110 may or may not be the basestation 110seen currently by the UE.

The target UNC acknowledges the request, using the RELOCATION REQUESTACKNOWLEDGE 2711, indicating it can support the requested handover,which also contains the HANDOVER COMMAND contents indicating the homebasestation radio channel parameters to which the UE should be directed.

The core network forwards the HANDOVER COMMAND 2713 to the GERAN,completing the handover preparation.

The GERAN sends the HANDOVER TO UTRAN COMMAND 2715 to the UE to indicatea handover to the basestation 110. The HANDOVER TO UTRAN COMMANDcontains the UARFCN and primary scrambling code of the targetbasestation. The UE does not switch its audio path from GERAN to UMANuntil handover completion.

The UE accesses the basestation 110 using the HANDOVER TO UTRAN COMPLETEmessage 2717. The handover reference contained in the message is passedto the UNA in the URR HANDOVER ACCESS message 2719, which allows theserving UNC to correlate the handover to the RELOCATION REQUESTACKNOWLEDGE message.

The serving UNC sets up the bearer path with the basestation 110 and UE.

The basestation 110 transmits the URR HANDOVER COMPLETE message 2723 toindicate the completion of the handover procedure. The UE switches fromthe GERAN user plane to the UMAN user plane.

Bi-directional voice and/or data traffic 2727, 2729, 2731 is flowingbetween the UE and core network via the serving UNC.

The target UNC indicates the handover is complete, using the RELOCATIONCOMPLETE message 2733. If not already done so, the core network switchesthe user plane from the source GERAN to the target UMAN.

The core network tears down the connection to the source GERAN using theCLEAR COMMAND 2735.

The source GERAN confirms the release of GERAN resources allocated forthis call, using CLEAR COMPLETE 2741.

The basestation 110 is designed to be used as a “public access” systemfor application in shops, bars, restaurants and other public areas, andas a restricted access system for application in homes and offices.

For public access application, the basestation 110 will identify itselfwith the same Public Land Mobile Network (PLMN) identifier as the owningoperator's network—the basestation 110 appears as another basestation inthe network which a mobile will roam onto when the received signalstrength of the basestation 110 exceeds that of other basestations.

For home or office applications it is often highly desirable to restrictaccess to the basestation 110 to only those subscribers who are payingfor the basestation 110 and associated DSL line. The present inventionincludes a scheme to control access to the basestation 110 devicethrough a modification to the phone SIM alone, with no requirement forcostly modification of a standard GSM/UMTS phone. Using this scheme theowning operator's basestation 110 devices all share a common butdifferent PLMN identifier to the operator's wide area network. When thisdifferent PLMN is set as the Home PLMN for a particular mobile in itsSIM card then that mobile will preferentially roam to the basestation110 whenever adequate signal level is detected, regardless of the signalstrength of other basestations on the operator's PLMN.

Standard GSM/UMTS UEs when not making a voice or data call—referred toas idle mode—will perform automatic PLMN selection in the followingorder of priority:

-   -   i) SIM card defined MNO HPLMN (Home PLMN)    -   ii) Other SIM card defined PLMNs specified by MNO supplying SIM    -   iii) Other detected PLMNs with sufficient signal strength

In idle mode, the MS periodically attempts to obtain service on itsHPLMN. For this purpose a value of T minutes may be stored in the SIM,range 6 minutes to 8 hours (in 6 minute steps). Therefore by making theHPLMN the MNO ZoneGate network identifier rove-in from the macro-networkto basestation 110-network will be automatically performed within aminimum of 6 minutes of the user entering the coverage area of the homebasestation 110. Rove-out shall be automatically performed when the useris about to leave the coverage area of the home basestation 110. Inorder to ensure correct rove-out behaviour the MNO PLMN networkidentifier should be the highest priority PLMN in the SIM after theHPLMN.

Note that PLMN selection and re-selection is only performed in idlemode. In connected mode, PLMN re-selection is not performed, unless aninter-PLMN handover is activated by the network.

In general, network users not enabled to use the basestation 110 wouldalready be on their HPLMN, or another PLMN if roaming, and would notattempt access to a basestation 110 PLMN unless there was nomacro-network coverage. For enabled users, access to a particularbasestation 110 is restricted to a small number of users provisioned onthat specific device. Because the basestation 110 acts as a standaloneGSM/UMTS network to the UE, it is able to extract the InternationalMobile Station Identifier (IMSI) from standard GSM/UMTS messagesexchanged with the UE and thereby make a decision as to whether the UEis allowed to make calls via that basestation 110 or not.

In normal macrocell operation, a UE registers onto a cell by means of alocation registration (LR) if the selected or reselected cell has adifferent registration area (LA/RA) or PLMN. If this is not the case theUE will use an IMSI attach or GPRS attach procedure to register on thatcell. The basestation 110 will configure itself to have a differentLocation Area (and therefore Routing Area) to the macro-network, so thata Location Registration procedure will always be necessary. An IMSIAttach may also be performed during the Location Registration procedure.

During the location registration procedure, a standard LOCATION UPDATINGREQUEST message is sent by the UE to the basestation 110, which containsthe IMSI. The basestation 110 can reject the request if the IMSI doesnot match that of one of the provisioned users without having to contactthe core network, therefore reducing possible network traffic. If theIMSI is not sent in the LOCATION UPDATING REQUEST, and the TMSI/P-TMSIis unknown by the basestation 110, the IMSI is obtained from the UEthrough the IDENTITY REQUEST procedure.

It is important to note that the basestation 110 is directly connectedto the owning operator's core network and any user roaming from theoperator's macro network to the basestation 110 will not be recorded ashaving left the operator's network by the HLR. The basestation 110appears as a separate network only to the mobile devices such that thedevice identities (IMSIs) are revealed via standard GSM/UMTS signalingprocedures as the devices cross this network boundary. This enablesaccess to the basestation 110 to be restricted to defined users.

The PLMN selection and Location Registration procedures are mapped bythe basestation 110 to the discovery and registration procedures foreither UMA or SIP:

For basestation 110 interfaced to the core network via UMA, the UMAdiscovery procedure is performed when a UE is first attempting service,in order to determine the identity of the default and serving UNC.Following completion of the UMA discovery procedure, the UMAregistration procedure is performed between the UE and the UNC in orderto inform the UNC that a particular UE is connected and available formobile-terminated services.

The UMA discovery and registration procedures are performed when a UEsuccessfully selects a particular basestation 110, provisioned to acceptit through the GERAN PLMN selection and cell selection procedures. Theprocedure is described above and illustrated in FIG. 11.

For a SIP-enabled basestation 110, the SIP registration procedure shownin FIG. 28 is performed during the UE location registration procedure,in order to register the SIP location information with the networkLocation Service via the network SIP Registrar Server. SIPauthentication may also be enabled during this procedure. The networkLocation Service holds the location of SIP User Agents so that they areavailable for mobile-terminated services.

SIP registration with a SIP proxy server shall be triggered by asuccessful Location Update (GERAN) or Registration Area Update (UTRAN)for registered ZAP UE devices.

Both SIP and UMA registration are only performed if the GSMIUMTSLocation Registration procedure is successful. Therefore access to bothUMA and SIP is restricted only to authorised users. A subset of the UEparameters exchanged during the Location Registration are also mapped tothe SIP and UMA registration procedures.

As mentioned above, the basestation 110 includes an Ethernet LAN port208 which allows the basestation to be connected into home or office LANnetworks. In this configuration the Ethernet LAN provides the connectionto the owning operator's network.

For deployment in areas where a single basestation 110 cannot providesufficient coverage, such as a large home or multi-floor office,multiple basestation 110 devices can be used to provide adequatecoverage. Users moving through the office will require their activecalls to be handed off between basestation 110 devices to provideseamless coverage. The basestation 110 can support this capability ifall the basestations within the office area are connected using asingle, common Ethernet LAN.

The handoff procedures use proprietary messaging transmitted betweenbasestations 110 in order to implement and coordinate the handover. TheMobility Management entities in the two basestations, namely the sourcebasestation ZG1 and the handover target basestation ZG2, communicateover the LAN connection using the proprietary messaging. The messagescontain information related to the GSM/UMTS settings in eachbasestation, and information related to the transfer of the current SIPsession.

Each Access Point for a basestation 110 is uniquely identified by a SIM.This may be provided as a physical SIM card or as a downloaded piece ofsoftware referred to as a “softSIM”. Each basestation 110 must have aPrimary User identified by the operator-supplied SIM of their mobilephone. The basestation Management system 160 will be provisioned withthe SIM identifiers for the basestations 110 and the Primary Users andwill define basestation User Groups which is an association between atleast one basestation SIM and a Primary User SIM. The Primary User willbe able to add other user SIMs to the basestation User Group using avariety of mechanisms such as authenticated phone call/email to theManagement System or interaction with the webserver of any basestationwithin the basestation User Group.

A basestation User Group will allow multiple basestation SIMs to beassociated with the same Primary User SIM. All the Access Points withinthe basestation User Group will allow access to the same list of userSIMs (as defined by the Primary User) and will be capable of handover toeach other using the proprietary mechanisms described below.Communication between the basestations within a basestation User Groupwill be enabled by the regular reporting of public or private IPaddresses back to the Management System; the Management System willcollate the IP address and permitted user information and periodicallybroadcast it to all basestations within a basestation user group.

A new Access Point being installed into an office environment wouldobtain an IP Address from the Ethernet LAN, establish communicationswith the Management System 160 and complete authentication usinginformation from the basestation SIM and Primary User SIM. It will thenbe added to the basestation User Group for that Primary User which isstored in the Management System 160. The newly installed basestationwill then report its IP Address to the Management System 160; theManagement System 160 will update the IP address tables stored for thespecific basestation User Group and broadcast the updated table and userlist to all basestations in the User Group, including the newlyinstalled Access Point. The newly installed Access Point will completethe remaining steps in the self-configuration process described aboveand will then attempt to communicate with each IP Address in the listbroadcast by the Management System; if communication is successful bothAccess Points exchange further information required such that they canadd each other to the BA lists information transmitted on the BroadcastChannel of each Access Point. (GSM/UMTS standards require thatparameters of surrounding basestations are included in the SystemInformation broadcast over the Broadcast Channel from any basestationsuch that UEs can monitor neighbouring basestations in preparation for apotential handover.) The information exchanged is summarized in table Ibelow:

TABLE 1 GSM/UMTS information exchanged between Access Points within aBasestation User Group Parameter Interface Description ARFCN, BSICGSM/GPRS The contents of the BA list are a list of the basestation 110ARFCN frequencies, and the BaseStation Identity Codes. A singlebasestation 110 shall have one ARFCN and one BSIC. CI GSM/GPRS/UMTS TheCell Identity of the basestation 110. LAI GSM/GPRS/UMTS The LocationArea Identifier that is broadcast by the basestation 110. RAI GPRS/UMTSThe Routing Area Identifier that is broadcast by the basestation 110.Primary Scrambling UMTS The primary scrambling code that is used Code onthe basestation 110 primary CPICH. UARFCN UMTS The basestation 110 UMTSbroadcast frequency.

The inter Access Point handoff mechanism described here is intended towork with SIP calls only. Seamless handoff to the wide area networkcannot be supported with this approach. IP addresses for the UE/MS arerequested from the DHCP server of the LAN to which the Access Points areconnected; the Access Point to which the MS/UE first connects will actas an IP address proxy for the MS/UE and will request an IP address onbehalf of the MS/UE which will be communicated to that MS/UE. As theMS/UEs are handed off between Access Points, the IP address of the MS/UEis preserved whilst the IP Address proxy function will transfer to thenew Access Point along with the handed-off MS/UE. For more complexnetworks where there is no single DHCP server Mobile IP techniques canbe used to preserve the MS/UE IP address for the duration of the call.

The handover signalling is shown in FIG. 29, which in addition dividesthe basestation 110 functionality into standard 3GPP elements RNS andMSC, where RNS denotes the UMTS Access Stratum protocol entities, andthe MSC denotes the Non-Access Stratum protocol entities. All Uu and luprefixed signalling is standard 3GPP signalling, all ZG prefixedsignalling is proprietary:

The following sequence of steps is executed:

The source basestation ZG1 determines that a handover is required, dueto the measurement reports 2901, 2903 received from the UE. Themeasurement reports indicate that the receiver power level at the UE forthe target basestation ZG2 is high, and that the receiver power level atthe UE for the current basestation ZG1 is low.

Basestation ZG1 initiates a handover by sending the internal RELOCATIONREQUIRED message 2905. The ZG1 sends the proprietary ZG-Handover-Requestmessage 2907 over the LAN to the target basestation ZG2 in order toinform the target that a handover has been requested. The IP address ofZG2 is already known to ZG1 during self-management of the basestationsin the LAN network.

The target basestation ZG2 determines whether the handover can takeplace, and returns the ZG-Handover-Response 2913 to indicate that therequest has been accepted. ZG2 generates internal signalling RELOCATIONREQUEST 2909 and RELOCATION REQUEST ACKNOWLEDGE 2911.

The ZG-Handover-Information-Request 2915 is transmitted from the firstbasestation ZG1 to the target basestation ZG2 in order to transfer thecurrent handover and SIP-client settings to the target basestation ZG2in preparation for the handover. The ZG-Handover-Information-Response2917 is transmitted in return to transfer the target GSM/UMTSradio-access settings to basestation ZG1.

The handover is initiated by basestation ZG1 by sending the PHYSICALCHANNEL RECONFIGURATION message 2921 over the UMTS air-interface to theUE. The message also contains the GSM/UMTS radio-access settings fromthe target ZG2.

The UE attempts to register on to the target basestation ZG2 throughstandard Layer-1 and Layer-2 signalling. The UE is detected bybasestation ZG2, which generates internal message RELOCATION DETECT2925.

The ZG-Handover-Detect-Request message 2927 is transmitted frombasestation ZG2 to the source basestation ZG1, to indicate that the UEhandover procedure has been successful.

Basestation ZG1 stops reception of the SIP call signalling and trafficpackets, and basestation ZG2 starts reception (i.e. processing) of theSIP call signalling and traffic packets. No re-routing of the UE/MS SIPpackets are required, as the target IP address is the UE/MS address, andhence is unchanged due to the handover. The LAN connection should ensureboth basestations are capable of receiving UE/MS IP packets.

The completion of the handover process is indicated by basestation ZG2generating the internal RELOCATION COMPLETE message 2931, and sendingthe ZG-Handover-Complete-Request message 2933 to basestation ZG1. ZG1releases the call internally through transmission of internal signallingmessages RELEASE COMMAND 2935 and RELEASE RESPONSE 2937.

There is therefore disclosed a basestation that allows access to anetwork operator's cellular network, using a standard cellular phone.

1. A basestation, for use in a cellular communications system,comprising: a radio frequency receive path; a radio frequency transmitpath; and a connection for a network; wherein, on installation, thebasestation is adapted to: configure the radio frequency receive path tooperate in a wireless communications network; monitor received signalstrengths on each of a predetermined plurality of network carriers;select, on the basis of said received signal strengths, a first of saidpredetermined plurality of network carriers as an operating downlinkcarrier; and select, on the basis of the received signal strength ofsaid selected first of said predetermined plurality of network carriers,an initial power level for said radio frequency transmit path; andwherein the basestation is further adapted to operate using saidoperating downlink carrier and a corresponding operating uplink carrier,following said installation.
 2. A basestation as claimed in claim 1,wherein said basestation is adapted to: configure the radio frequencyreceive path to operate in a first wireless communications network;monitor received signal strengths on each of a predetermined pluralityof network carriers of said first wireless communications network;select, on the basis of said received signal strengths, a first of saidpredetermined plurality of network carriers of said first wirelesscommunications network as an operating downlink carrier of said firstwireless communications network; and select, on the basis of thereceived signal strength of said selected first of said predeterminedplurality of network carriers of said first wireless communicationsnetwork, a first initial power level for said radio frequency transmitpath; configure the radio frequency receive path to operate in a secondwireless communications network; monitor received signal strengths oneach of a predetermined plurality of network carriers of said secondwireless communications network; select, on the basis of said receivedsignal strengths, a first of said predetermined plurality of networkcarriers of said second wireless communications network as an operatingdownlink carrier of said second wireless communications network; andselect, on the basis of the received signal strength of said selectedfirst of said predetermined plurality of network carriers of said secondwireless communications network, a second initial power level for saidradio frequency transmit path; and wherein the basestation is adaptedto: operate using said operating downlink carrier of said first wirelesscommunications network and a corresponding operating uplink carrier ofsaid first wireless communications network, and using said operatingdownlink carrier of said second wireless communications network and acorresponding operating uplink carrier of said second wirelesscommunications network, following said installation.
 3. A basestation asclaimed in claim 2, wherein the first wireless communications network isa GSM network.
 4. A basestation as claimed in claim 2, wherein thesecond wireless communications network is a UMTS network.
 5. Abasestation as claimed in claim 2, wherein each of said predeterminedplurality of network carriers of said second wireless communicationsnetwork comprises a respective carrier frequency and a scrambling code.6. A basestation as claimed in claim 2, wherein the first of saidpredetermined plurality of network carriers of said first wirelesscommunications network is selected as an operating downlink carrier ofsaid first wireless communications network on the basis that it has thelowest of said received signal strengths of said predetermined pluralityof network carriers of said first wireless communications network.
 7. Abasestation as claimed in claim 2, wherein the first of saidpredetermined plurality of network carriers of said second wirelesscommunications network is selected as an operating downlink carrier ofsaid second wireless communications network on the basis that it has thelowest of said received signal strengths of said predetermined pluralityof network carriers of said second wireless communications network.
 8. Abasestation as claimed in claim 1, having an interface, for connectionto equipment of an operator of the wireless communications network, overan IP network.
 9. A basestation as claimed in claim 8, wherein saidinterface is an interface for connection over a digital subscriber line.10. A basestation as claimed in claim 8, wherein said interface is aninterface for connection over a cable telecommunications line.
 11. Abasestation as claimed in claim 8, wherein said interface is aninterface for connection over a wireless IP network.
 12. A basestationas claimed in claim 1, having an interface, for connection to a localarea network.
 13. A basestation as claimed in claim 12, wherein saidinterface, for connection to a local area network, comprises an Ethernetconnection.
 14. A basestation as claimed in claim 1, having a USBinterface.
 15. A basestation as claimed in claim 1, having an interface,for connection thereto of a POTS device.
 16. A basestation as claimed inclaim 1, further comprising a Subscriber Identity Module.
 17. Abasestation as claimed in claim 1, wherein the or each initial powerlevel is constrained to be within a respective range, wherein upperlimits of each of said ranges are below a respective maximum power levelavailable in the respective wireless communications network.
 18. Abasestation as claimed in claim 1, wherein the basestation is adapted todownload from a remote management system a list of said predeterminedplurality of network carriers.
 19. A basestation as claimed in claim 1,wherein said predetermined plurality of network carriers, on which thebasestation is adapted to monitor received signal strengths, includefrequencies on which surrounding GSM basestations are transmitting. 20.A basestation as claimed in claim 19, wherein said basestation isadapted to monitor said received signal strengths while configured tooperate on GSM downlink 15 frequencies.
 21. A basestation as claimed inclaim 1, wherein said predetermined plurality of network carriers, onwhich the basestation is adapted to monitor received signal strengths,include combinations of UMTS carriers and scrambling codes on whichsurrounding UMTS basestations are transmitting.
 22. A basestation asclaimed in claim 21, wherein said basestation is adapted to monitor saidreceived signal strengths while configured to operate on UMTS downlinkfrequencies.
 23. A basestation, comprising: radio transceiver circuitry,for connection to wireless communications devices by means of a cellularwireless communications protocol; and an interface, for connection overan IP network; wherein the basestation is adapted to communicate usingUMA standard protocols over said IP network with a UMA networkcontroller, in order to provide communications with said wirelesscommunications devices by means of said cellular wireless communicationsprotocol.
 24. A basestation as claimed in claim 23, wherein saidbasestation is adapted to transfer data, received in a format accordingto said cellular wireless communications protocol, into a formataccording to the UMA protocol.
 25. A basestation as claimed in claim 23,wherein said basestation is adapted to transfer data, received in aformat according to the UMA protocol, into a format according to saidcellular wireless communications protocol.
 26. A basestation as claimedin claim 23, wherein said cellular wireless communications protocol isthe GSM protocol.
 27. A basestation as claimed in claim 23, wherein saidcellular wireless communications protocol is the GPRS protocol.
 28. Abasestation as claimed in claim 23, wherein said cellular wirelesscommunications protocol is the EDGE protocol.
 29. A basestation asclaimed in claim 23, wherein said cellular wireless communicationsprotocol is the UMTS protocol.
 30. A basestation as claimed in claim 29,wherein said cellular wireless communications protocol is the HSDPAprotocol.
 31. A basestation as claimed in claim 29, wherein saidcellular wireless communications protocol is the HSUPA protocol.
 32. Abasestation as claimed in claim 23, wherein said basestation is adaptedto communicate via said UMA network controller with a radio network of awireless communications network.
 33. A basestation as claimed in claim23, wherein said basestation is adapted to communicate via said UMAnetwork controller with a core network of a wireless communicationsnetwork.
 34. A basestation as claimed in claim 33, wherein saidbasestation is adapted to request a ciphering key from said core networkof said wireless communications network, and, after receipt of saidciphering key, to use said ciphering key for communications with saidwireless communications devices.
 35. A basestation as claimed in claim23, wherein the basestation is adapted to communicate over said IPnetwork with said UMA network controller, in order to providecommunications between said wireless communications devices and a GSM orUMTS radio network, in order to support handover.
 36. A basestation asclaimed in claim 35, wherein, when a wireless communications device hasan active call with a node of the GSM or UMTS radio network, and ahandover to said basestation is required, a handover message is sentfrom the basestation over said IP network to said UMA networkcontroller.
 37. A basestation as claimed in claim 35, wherein, when awireless communications device has an active call with said basestation,and a handover to a node of the GSM or UMTS radio network is required, ahandover message is sent to the basestation over said IP network fromsaid UMA network controller.
 38. A basestation, for use in a cellularcommunications network, wherein the basestation is operable such thatonly specific preconfigured mobile stations are able to connect to saidnetwork by means of the basestation.
 39. A basestation as claimed inclaim 38, wherein the basestation is operable: in a first mode, whereinonly specific preconfigured mobile stations are able to connect to saidnetwork by means of the basestation; and, alternatively, in a secondmode, wherein any mobile station active within said network is able toconnect to said network by means of the basestation.
 40. A method ofcontrolling access to a cellular wireless communications network, themethod comprising: identifying a sub-network comprising at least onebasestation in said network by means of a first identifier which differsfrom identifiers used to identify other basestations in said network;setting said sub-network as a home network for at least onepredetermined mobile communications device in said network; andconfiguring the or each basestation in said sub-network, such that onlythe or each predetermined mobile communications device is able to accesssaid network through the or each basestation in said sub-network.
 41. Amethod as claimed in claim 40, wherein the or each predetermined mobilecommunications device in said network accesses said network through thebasestation or one of said basestations in said sub-network whenavailable, in preference to other basestations in said network.
 42. Amethod as claimed in claim 40, wherein said sub-network is set as a HomePLMN for the or each predetermined mobile communications device.
 43. Amethod as claimed in claim 42, wherein said sub-network is set as a HomePLMN in a Subscriber Identity Module of the or each predetermined mobilecommunications device.
 44. A method as claimed in any of claims 40-42,wherein the or each basestation in said sub-network stores InternationalMobile Subscriber Identities for the or each predetermined mobilecommunications device, and permits access only from mobilecommunications devices having one of said stored International MobileSubscriber Identities.
 45. A telecommunications network, comprising: aplurality of basestations, each having a respective connection to acellular wireless communications network, and each having a respectiveconnection to an IP network; wherein a mobile communications device,active in said wireless communications network, can perform a handoverfrom one of said basestations to another of said basestations, withoutrequiring intervention of said cellular network.
 46. Atelecommunications network as claimed in claim 45, wherein: when amobile communications device is in communication with said cellularnetwork through one of said basestations, and said one of saidbasestations determines that a handover to another of said basestationsis desirable, said one of said basestations is adapted to send ahandover request message to the other of said basestations by means ofsaid IP network.
 47. A telecommunications network as claimed in claim 45or 46, wherein said IP network is a local area network.
 48. Abasestation, for use in a cellular communications system, comprising: aradio frequency receive path and a radio frequency transmit path, forcommunicating with one or more mobile communications devices activewithin said cellular communications system; a connection forcommunicating with a network infrastructure of said cellularcommunications system; an interface for an IP network; wherein thebasestation is adapted to: detect any other basestation able tocommunicate with said cellular communications system and having aninterface for said local area network; receive from a mobilecommunications device communicating with said cellular communicationssystem therethrough; determine on the basis of the received measurementreports when a handover to another of said basestations is desirable;and in that case, send a handover request message to the other of saidbasestations by means of said IP network.
 49. A basestation as claimedin claim 48, wherein said IP network is a local area network.